Note: On August 5th, crypto researcher Jon Charbonneau released the “Complete Guide to Rollup” on Delphi Digital, starting from the two well-known projects of Ethereum and Celestia, which elaborated the technology and economy of Rollup in detail. In this regard, Buterin praised, saying that this is a “good book” about Rollup.
The article is mainly divided into three parts, namely modular economics, Ethereum Rollup stack and Celestia Rollup stack.
The following is an introduction to the article and the first part – Modular Economics, compiled by The Way of DeFi.
Vitalik contributed his masterpiece The Incomplete Guide to Rollup, and I’ll show you The Complete Guide to Rollup.
Well, actually it wasn’t complete either, but it sounded pretty cool, so I decided to go with that name. This report only analyzes the design space for rollups on Ethereum and Celestia. I highly recommend my recent Ethereum report for background reading.
In this report, I’ve covered the two projects I’m most familiar with, but there are actually many other teams building. Polygon (Avail), Tezos and Milkomeda etc. are also in the Rollup stack game. In fact, Tezos is likely to be the first to introduce an “enshrined” rollup, and Polygon Avail is surprisingly similar in architecture to Celestia.
First, what is a “modular” blockchain? At this point it’s mostly a meme at the moment, with a lot of disagreement, but for simplicity I’ll define how I use the term. Of course, as to whether it’s right or wrong, you can discuss it in my Twitter comments.
The modular stack strips the following tasks into independent technology components:
- Data Availability (DA) – ensuring that the transaction data behind the rollup block header has been published and available so that anyone can recreate the state.
- Consensus – at least agreement on transactions and their ordering.
- Settlement – Varies depending on implementation, but tasks can include verification/arbitration of proofs and coordination of cross-chain asset transfers/arbitrary messaging.
- Execute — Calculation takes the pre-state → runs the transaction → transitions to the post-state.
Ethereum can handle every one of them. It provides a unified DA, consensus and settlement layer with universal execution. When you transact on L1, Ethereum acts like any monolithic chain. Additionally, rollups can handle execution, with Ethereum providing DA, consensus and settlement.
Celestia only provides DA and consensus. There is no Uniswap on L1 Celestia, and no L1 proof of verification/quorum. Celestia has no enforced settlement layer or smart contract execution. The functionality of L1 is limited to Celestia token transfers and validator set management.
Note that there is also the possibility of using separate layers for DA and settlement like Validiums and Celestiums. Any settlement layer can be used as long as it accepts data proofs provided by Celestia.
However, these are not rollups, but they bring meaningful additional security assumptions. This report will focus on the actual “rollup” stack. I’ll break down the economics first and then dive into each stack.
Some abbreviations used in the text are as follows:
- SCR–smart contract rollup
- ER – Enshrined rollup
- SR – Sovereign rollup
Part 1: Modular Economics
Previously, I have written about the importance of L1 value capture (fees and other forms of MEV). Assets that depend on economic safety require a high-value collateral. Income fuels attractive monetary policy (real yields, low and predictable inflation, etc.). Value capture → good monetary policy → currency premium → high economic security. Fees and other MEVs initiate step 1.
Let’s analyze a rollup transaction from first principles. This simplified diagram depicts the parts that apply to Ethereum optimistic rollups (ORU) and zk-rollups (ZKR).
- The sequencer receives and orders transactions. Users will soon be able to get soft confirmations that their transactions are finally recorded on L1 (if they trust the sequencer’s feedback). The sequencer is only used for ordering and transaction completion. They cannot submit invalid transactions.
- A deterministic state transition function processes each transaction and updates the L2 state, creating an L2 block. These blocks can be generated faster than L1 blocks.
- Every so often a batch of transactions is compressed and sent to L1. Currently stored as calldata, but eventually rollups will use data blobs.
Users are charged L2 gas when applying state transitions and executing their transactions. L1 gas is paid later when batch transactions are processed. L1 and L2 gas prices vary according to their respective congestion conditions. Therefore, users incur fees in both types of gas, and there is a time mismatch. The sequencer commits to the transaction and collects the L2 fee before it knows the full content of the batch transaction, how compressed it is, or what the base fee for L1 is when it is published.
L2 does its best to guess what its L1 fee will be and charges users accordingly. When the market is calm, L2, on average, charges only a small profit on top of L1 costs. But when rollups become constrained by their own execution environment (rather than L1 cost), this magnitude increases. The surge in pricing in the toll market acts on demand. Higher profit margins correspond to a surge in local demand.
We’ve seen this clearly in Arbitrum’s recent surge, although its margins have been otherwise stable. Arbitrum’s recent bottleneck is L2 execution (rather than L1 cost), so its local fee market kicks in:
We see a similar trend with Optimism, albeit more variable:
The L1 cost of Rollups today is mainly calldata. Even for ZKRs, Polygon’s fee for posting transaction data to Ethereum is estimated to be ~90% of the total cost (this is mostly calldata), in addition to ~10% for proofs. With EIP-4844 likely to appear in next year’s Shanghai hard fork, these costs will drop significantly. It increases DA throughput and enables separate EIP-1559 fee markets for Ethereum’s DA layer and settlement layer. An oversupply of DA means fees are hitting the bottom line. After that, danksharding will make DA richer. A Rollup with any reasonable activity will greatly increase these profit margins.
Finally — the data above does not include any MEV (outside of regular transaction fees). In reality, rollup tokens are able to accrue a lot of value from MEVs (more on this soon).
fixed cost vs variable cost
The ORU publishes the compressed full L2 transaction data (with signature), L2 state root and fraud proofs (only in case of disputes) back to L1. While the full transaction data is stored in Ethereum’s history, the hash of the transaction data is added to its state. If a fraud proof is sent, then it can check the proof of inclusion against the previously stored hash as part of the fraud proof.
ZKRs do not need to publish all transaction data to L1. Just posting the state difference is enough (they chose to do this because it’s cheaper). Imagine Alice and Bob trading 1 ETH back and forth in this batch of transactions – ZKRs only need to post the state change at the end (who owns the 1 ETH and who doesn’t), while ORU needs to post every transaction. The state difference is enough to reconstruct the state. The ORU must include all transactions for fraud proof purposes. ZKR validators must also include a validity proof, along with each batch, proving that the associated state root is valid.
SCRs have fixed costs regardless of the transaction activity they have to pay to Ethereum:
- state commitment
- Proof of validity (only for ZKRs)
In addition, they have variable costs that increase as transaction activity increases.
- Transaction data (plus ORU’s signature)
On top of these fees paid to L1, rollup charges a surge pricing for the necessary L2 gas fees and costs to cover the rollup operator. A more detailed analysis can be viewed here.
Note the time/cost tradeoff here. Frequent settlement means that L1 gives the true final result earlier. However, waiting longer to settle, amortizing these fixed costs over more transactions = cheaper transactions for rollup users. Rollup settlement balances adequate security with low fees that give users a low guarantee (pre-confirmation).
Let’s take Optimism as an example. As background, on Optimism, sequencers and proposers need to publish information for two smart contracts:
- Canonical Transaction Chain (CTC) contract — an appendix-only log of transaction batches submitted by the sequencer
- State Commitment Chain (SCC) contract — Proposer confirmation is the log of the proposed state root for each transaction result in the CTC
The cost breakdown of Optimism is shown in the following figure:
There are two costs associated with publishing transaction batches on the Canonical Transaction Chain (CTC):
- Variable cost – Calldata gas used by L1 CTC (transaction batch) submitters, roughly linear in the size of the transaction batch
- Indirect costs – there is also a small non-calldata cost of publishing information to the CTC
The gas used to publish the state root to the State Commitment Chain (SCC) is a purely indirect cost (note that part of this cost also uses L1 calldata). Splitting it up according to the above two costs, you get something like this:
These overhead costs may be higher than you might expect — there are still many inefficiencies that need to be addressed in the coming months. An optimization like Bedrock’s would greatly improve data compression, and it would bring the fixed cost down to almost negligible. The gas cost per batch of transactions can be reduced from ~280,000 per batch excluding calldata to ~21,000 gas per batch. SCC will be replaced by L2 OutputOracle and CTC will be removed. L2 blocks will be saved to Ethereum using non-contract addresses, greatly reducing the on-chain footprint and minimizing gas costs.
Likewise, the gas cost of Arbitrum per batch is about 375,000, which will be greatly reduced by Nitro.
Putting it all together, the rollup’s value stream can be described. The image below is from a great article by Barnabé Monnot:
He also recently touched on this topic.
Base Layer Fees – Ethereum
Ethereum fees come from:
- L1 Execution and Settlement – eg go to Uniswap at L1 and exchange some USDC for ETH.
- Settlement from Rollups – Rollups publish proofs to L1. Ethereum is also responsible for handling trust-minimized bridging between rollups and L1.
- DA from Rollups – Rollups use calldata to publish data to L1.
The cost of a separate monomer chain is capped at:
Fees = Throughput x USD users will pay for a single transaction
In contrast, modular DA and settlement layers (like Ethereum) have a higher fee cap:
Fees = Throughput x USD users will pay for aggregated transactions
Rollup can pay Ethereum a larger single fee to settle many transactions than a single user would pay for an L1 transaction that occupies the same block space (e.g., one proof guarantees many blocks, settles many aggregated DeFi pool transactions, etc.). Assuming there is enough demand, introducing new fee payers (rollups) to Ethereum, with higher marginal utility per transaction, will add value in the long run.
Note, however, that Ethereum revenue today looks like this:
Ethereum is a long way from being the primary settlement or DA layer for rollups. The vast majority of fees paid to L1 come from native L1 execution:
So while a modular base layer can extract meaningful revenue from the needs of a rollup, we need to have a lot of demand before doing so. Crucially, Ethereum’s rollup fee is complementary to its native L1 execution, not solely dependent on it.
Where this value capture comes from is a point of contention. Many in the Ethereum and Celestia communities believe that DA will eventually have amazing value. Dankrad recently gave his opinion on his podcast with John Adler, which I host.
“Assets… need to get security from some… means of generating yield. So I think there are only two at the moment, and that is the settlement layer and the data availability layer. I think in the short term, we may see that the settlement layer remains Generating more value.
We’ve seen in the past that we had a ton of fees on Ethereum and some on other settlement layers. But in the long run, I believe the most valuable asset will just be in the availability of data, Blockspace will be the most valuable asset in a decentralized economy.”
What Rollup should be willing to pay for premium DA is an interesting debate. However, the reality is that DA will soon be massively oversupplied between Ethereum scaling and alternative DA solutions. The scale of data availability can be seen in the following figure:
The current average data for an Ethereum block is ~90 KB, of which calldata is ~10 KB. With a DA supply shock looming, rollup will continue to greatly improve data compression. When data blobs have their own fee market, supply < demand, DA fees hit the bottom line.
Rollup users will pay higher fees, but the main bottleneck is likely to be rollup’s own native execution environment (based on current EIP-4844 activity and DA bandwidth on orders of magnitude). When you swap tokens on your favorite rollup, DA will no longer be your main cost. Super cheap fees will drive incremental activity, more rollups, etc. Only when the DA is saturated to the target, the EIP-1559 mechanism will kick in, pulling the fee out of the lower bound. However, rollups have a number of upcoming optimizations that will strengthen their currently limited local execution. If that goes away, it could end up making DA a bigger cost again.
For Ethereum to start charging any meaningful DA, you need more than 1.3 MB/s (assuming current danksharding specs) of actual valuable data, demanding maximum security. Even if you hit 1.3 MB/s, the overflowed data can go directly elsewhere. Alternatives like Celestia, DataLayr, DACs, Adamantiums, Polygon Avail, etc. will provide a lot of cheap DA. Only the safest transactions require full Ethereum security. Also, the throughput of the DA can be safely increased (with more validators), so 1.3 MB/s is not a fundamental limit.
I am confident that DA fee income will be negligible compared to Ethereum’s strong settlement layer, at least for a few years.
Finally, the execution of native smart contracts can also provide ETH stakers with more value than Celestia – ETH can earn additional income as a productive asset. In particular, EigenLayerr is an innovative solution that will allow “restaking” of ETH. ETH stakers will be able to subject their shares to additional slashing conditions. They will ensure that new applications seeking to take advantage of ETH’s economic security will have their fee income credited to ETH (much like Cosmos’ concept of interchain security, which credits value to ATOM).
Base Layer Fees – Celestia
Celestia’s only fee is DA. Rollups handle settlement. In the same podcast, John made an interesting point about dYdX’s decision to move from StarkEx to Cosmos. The base layer should accumulate as much value as possible for economic security, but economically rational applications want to accumulate as much value as possible for themselves. Other things being equal, they would rather not pay rent to the settlement layer. DA is the lowest cost of shared security. This has less accumulated value for Celestia, but it can incentivize more rollups to stay because it’s cheaper.
For this statement, I do not agree, the reason is that I emphasized earlier. The cost paid to the settlement layer is actually relatively low. For ZKRs, the cost is close to 0, because the fixed cost is amortized over many transactions, except the ones that are settled, for which the user can pay (so the rollup does not pay this fee). For ORU, there is no real settlement cost. So I think this part of the cost in the equation is negligible — teams will choose between SR or using a settlement layer depending on their particular needs. Both have interesting technical and social arguments that I’ll dig into later.
If Celestia’s business model of slicing less of the larger pie is successful, it may also be important to note that the percentage of value captured. If the base layer only captures insignificant value relative to the value it secures, the safety lever becomes uncomfortable. Maybe you’re comfortable with a $1 billion bet securing $20 billion in value (Ethereum’s security ratio is currently ~20x), but are you comfortable with $100 billion? What about $200 billion? There is no right answer. An economically self-sufficient base layer, even without rollup income, would not have this concern.
It remains to be seen whether relying on DA alone will provide enough value capture to establish economic security. DA is valuable, but it is a resource that we know how to scale well. To change this, a paradigm shift is required. But looking at 5+ years, I don’t think anyone can reasonably predict.
So that’s exactly what I’m going to do now. Roughly calculated, DA’s data might look like this this year:
Not bad, $30 billion!
From where we are today, 13 bytes per transaction would be a meaningful optimization, but it’s only possible. For example, Polygon Hermez predicts that they will eventually only need 14 bytes per transaction. At the current danksharding spec of 1.3 MB/s, you get a nifty 100k TPS. Note, however, that most rollups today are nowhere near 13 bytes per transaction, you can only get to that low number by posting state differences like ZKRs. If you publish full transaction data like ORU, the value will be much higher, and even some ZKRs will choose to publish full transaction data. It is very optimistic that each rollup will operate near the lower bound of DA efficiency.
Note that the $0.01/tx I am assuming here is for DA only. This does not include consideration of other L2 transaction fees. Valuable real estate (e.g. rollups in DeFi hubs) can certainly charge a premium, but cheaper states tend to charge lower execution fees. That might even be enough buffer to clear Vitalik’s $0.05 test.
It will be important to consider how these margins stack up on L2 fees in the long run (ie, what percentage is paid for DA). If it becomes easy to flip many chains, and the bridging becomes so good that an application-specific rollup eventually makes sense, execution may become relatively cheap. This leaves some room for the DA to earn some fees. Important bridging developments will also have a big impact on whether SR makes more sense than a shared settlement layer, and the overall stickiness of DA.
For reference, Ethereum earned around $10 billion in fees in 2021, with a monthly annualized run rate of over $20 billion at its peak (note that this excludes other forms of MEV). Something like $30 billion/year could mean a market cap of hundreds of billions? But is that enough? I have no idea. Personally, I’d prefer much higher security at the nation-state level, so it’s a philosophical debate. At this scale, you need to secure trillions of dollars of economic activity, so I want more.
Note the difference between Ethereum and Celestia here. “Meaningful” means something different to everyone. Maybe 10% of total Ethereum revenue makes sense, maybe 20%. It has the settlement layer to pay the bills anyway. And for Celestia, it’s simple — it has to be enough to fund its entire security budget to protect everything it’s built on.
The reality is that we shouldn’t be skeptical of these numbers. They’re completely concocted in a super-optimized rollup world that gives you an order of magnitude feel over a long time frame.
Celestia faces a hurdle in bootstrapping economic security with little value capture. We’re used to seeing startup valuations as a bet on future growth, but it’s an accepted risk proposition when the entire business model (DA) depends on a paradigm shift to accrue enough value to achieve economic security.
MEVs in a modular stack
MEV is a deep rabbit hole, so I’ll keep it short here.
Let’s start with the basics. MEV is still not fully formally defined, but I’ll simplify it here to all the potential value that a block producer can extract (including regular transaction fees, arbitrage, liquidation, etc.).
The simplified L1 Ethereum MEV will be similar to the in-protocol PBS (or mid-term MEV-boost):
Searchers bundle deals together and bid builders to be included in the deal. Builders aggregate bids from searchers and bid for the entire block included by validators. In an efficient market, searchers bid the majority of their revenue to builders, who in turn bid the majority of their revenue to validators. Therefore, ETH captures most of the MEV.
As for Rollup, it looks a little different, but similar concepts apply. Here is a simplified example of Optimism running a MEV auction (MEVA) for sequencing rights:
Likewise, searchers bundle deals and bid on sequencers for inclusion. The sequencer aggregates bids from searchers and bids to include the entire block in the MEVA. In an efficient market, searchers bid most of their revenue to sequencers, who in turn bid most of their revenue to MEVA. If the rollup uses staking to elect leaders, you can also plug in validators instead of MEVA. In either case, the rollup will capture most of the MEVs. This can accrue to tokens, or to fund public goods etc. (like Optimism does).
Other things being equal, transferring transactions from L1 to rollup does not change the number of MEVs. It just changes how it gets and who gets it. In this simplified model, the acquisition of MEVs has now been pushed from L1 assets to L2 assets.
But honestly, is it that simple?
Sorry, I don’t know, and neither do anyone else. So if you’re a curious guy, this is a great area to study. How much MEV will leak into the shared DA and/or settlement layer? Will Rollup operators start paying L1 for MEVs they perform on L2? If something like cross-domain Flashbots emerges, we can collect more specific data. But for now, let’s first look at some assumptions.
At its simplest, it will accumulate to the bottom of the stack forever. For example, look at a stack with Celestia DA + settlement rollup + recursive rollup. A recursive rollup may rely on a cross-chain MEV that settles the rollup, but the DA layer may be able to censor and delay the block that settles the rollup, requiring a portion of that MEV to be taken. This negotiation depends on social norms and can be insurmountable lines (similar to a time bandit attack in PoW). The power is there, but will this negotiation happen? Maybe L1 wants to eat this L1 lunch, maybe not.
Then there are the more complex cross-chain MEVs. In the following example:
- R = Rollup
- B = block
- S = swap
R1 and R2 have coordinated sequencers and share the same DA layer, allowing atomic cross-chain MEVs. Each rollup can submit blocks, the acceptance of which depends on the other rollup. For example, R1 B1 (including S1) is only accepted if R2 B2 (including S2) completes, and vice versa, the same is true for R2’s condition. Likewise, a rollup can submit two blocks to its DA layer, one for the base case and one for inclusion only if certain conditions of the other rollup are met. The atomicity introduced here can be quite powerful, and it will be interesting to see how it affects the dynamics of MEV value accumulation.
Importantly, this is a bummer for value accumulation. If more MEVs leak out than we know so far, then this could be of great value to Celestia. This will help subsidize the security budget.
Economic security at the DA layer
Now let’s see why we even care about the economic security of the DA layer.
It’s simple — just pause the chain. If Tendermint does not have the necessary votes, it cannot make progress (invalidate) and cannot finalize (⅔). Rollups that depend on Celestia won’t like this.
Ethereum runs Gasper to reach consensus. Therefore, even if >⅓ of the shares are in question, Ethereum will continue to function, maintaining validity. However, this ledger cannot be finalized without the necessary votes. If >⅓ in question simply don’t vote, they will be subject to additional penalties due to the inactivity leak mechanism (negative penalty mechanism) until the protocol can finally be finalized again.
First – the validity condition is part of the consensus. So even if you control 100% of the shares, you can’t start printing a bunch of Celestia tokens/Ether out of thin air, stealing funds, etc. Honest nodes will refuse to do this because it is invalid. But you can try these:
Double Signing — Re-orgs are possible in Gasper, but not in Tendermint. You can still double sign, though, and cause confusion. The chain will stop and revert to social consensus. It can be shown that at least ⅓ of the pledge is double signed on the same block height and will be slashed in the protocol. So you can do this, but it’s expensive (if the value of the staking is high).
Data Withholding Attacks – Finalize a block, but never provide the data behind it. Withholding data is a non-attributable negligence and therefore cannot be forfeited in the agreement. Social coordination is required to punish attackers outside the protocol through hard forks. This is probably the worst attack on rollup. You will not be able to submit fraud proofs for an invalid ORU, nor will you be able to recreate the state for a ZKR. Thankfully, we have Data Availability Sampling (DAS) nodes. They just check that the data is available, so even if the consensus signs the block, they know to reject it.
Fraud-proof censorship — A censored DA layer can maliciously bridge funds on different rollups (even rollups within the same DA security zone). This cannot be protected by running a DAS node. This question is a bit subtle, so I’ll give an example.
SR1 (sovereign rollup) is an ORU on Celestia that wants to bridge funding for SR2. One option is to directly embed light clients of the other side into each rollup and distribute proofs in a P2P fashion. There are no censorship attack vectors that pass malicious consensus here (other attack vectors exist, such as eclipse attacks). Additionally, SR1 can publish fraud proofs directly to SR2’s namespace Merkle tree when it wants to bridge. This effectively replaces the synchronization assumption (in the case of P2P bridging) with Celestia’s honest majority assumption (in the case of publishing to Celestia). SR2 just looks for a proof on its own NMT that it is already tracking, and executes it when it sees it. However, now this allows SR1 to maliciously bridge funds to SR2, and Celestia can review your proofs at the DA layer. Ethereum can also review fraud proofs sent to smart contracts, which is why their ORUs require such a long timeout period.
Data withholding and censorship attacks do not directly affect the DA layer itself, but they are attack vectors for rollups that rely on the DA layer.
The TLDR–DA layer needs to be economically secure. With varying degrees of share being taken over, you can behave badly. A key point that gets confused by a lot of people is — just because something is safe to rely on, doesn’t mean it’s valuable. You must first build a valuable asset before you can rely on it for meaningful economic security. An asset that secures the system needs some way to accumulate value and/or a monetary premium.
If you want to witness the great modular wars of our time, read this thread. Open it up on Treeverse and spend the whole day sifting through it. The vast majority of this report (and to be honest, most of my cryptocurrency knowledge) came from the process of taking notes while I was watching Twitter clutter.
Revenue generation is a key component of building economic security, so understanding the value flow in a modular stack is critical to design. Base layer native assets need to be designed to capture value (fees and other MEVs) and/or be good money.
As it stands, the value captured by DA is negligible. This will remain the case for the foreseeable future. The rollup execution layer currently captures relatively little value. As certain tiers become popular and may contain high-value financial transactions, they may see meaningful revenue. A good general purpose settlement layer with high value transactions will likely dominate for the foreseeable future (maybe even an L2 settlement layer, like StarkNet plans to add many L3s on top of the L2 layer).
This is Russ from “Silicon Valley” who put radio on the Internet. Don’t be like Russ.
Posted by:CoinYuppie，Reprinted with attribution to:https://coinyuppie.com/delphi-digital-the-complete-guide-to-rollup-part-1-modular-economics/
Coinyuppie is an open information publishing platform, all information provided is not related to the views and positions of coinyuppie, and does not constitute any investment and financial advice. Users are expected to carefully screen and prevent risks.